1.1 Empowerment of Private and Public Actors Beyond the State

The first actor-related development concerns actors other than states. This involves both private actors and public actors such as international and regional organizations. For these groups of actors, digitalization has influenced and continues to influence their role in international legal practice.

To start with, private actors are empowered in the context of digitalization. In this regard, digitalization seems to foster, or at the least contribute to, an ongoing development that is taking place in international law more generally.Footnote ¹²

In the context of digitalization, a first set of empowered private actors are corporate entities. First, these entities assume novel roles as to the creation of legal norms and institutions. This is particularly apparent in the human rights context. Tech companies that shape the interactions, platforms and tools used in the digital sphere create (part of) the rules that govern these interactions from a human rights perspective. This includes, for example, the community standards or guidelines used by platforms such as Facebook and Twitter. These standards are a set of private norms that constitute the core—although not the exclusive content—of what has come to be termed Platform Law.Footnote ¹³ What is more, with the creation of the Meta Oversight Board, private corporate entities also have started to construct institutions that fulfill traditionally public functions such as adjudication. And, as Gulati observes in his contribution to this special issue, these privately created institutions in turn influence the content of platform law and potentially human rights law more generally.Footnote ¹⁴ In this regard, tech companies have become “key players”Footnote ¹⁵ in a field that was initially left unregulated by states, and which they have only gradually tried to penetrate. This has created a de facto regulatory competition that empowers corporate actors while “replacing” states as regulatory agents to some extent.Footnote ¹⁶ As a further result, “digital human rights law” is, as outlined by Shany, considerably dependent on private actors. As he observes, “the enjoyment of digital rights is heavily dependent on the conduct of private companies” such as digital platforms and service providers.Footnote ¹⁷ Moreover, beyond the human rights context, private actors play an increasing role in international institutional settings as well as the application of law. Villarreal has noted this development in the context of international health law, commenting that the ongoing “private turn” in this field of law as to financing of institutions and normative standard setting has been corroborated for law application where novel digital health tools are involved, including when disease surveillance is delegated to private actors.Footnote ¹⁸

Normatively, authors evaluate this development in divergent manners. For Tsagourias, it bears the risk that “states and individuals may transfer their allegiance from international law and institutions responsible for its creation, interpretation, and application to private companies and their regulatory frameworks.”Footnote ¹⁹ In contrast, for Gulati, the empowerment of private actors comes with chances for international law and institutions, for example, as to innovative ways of guaranteeing access to justice.Footnote ²⁰ These innovative institutional forms and regulatory approaches adopted by the actors that dominate the digital sphere today also make it likely, according to Gulati, that other tech companies adopt a similar strategy.

An additional development empowers corporate actors without replacing states in their regulatory function: Digitalization can trigger a broadened international legal protection of corporate entities. For international investment law, Polanco points out that corporate entities benefit from the fact that new fields of their activities, especially in relation to the use of data, are protected.Footnote ²¹ And in enforcement law, as highlighted by Ryngaert, corporate entities can obtain a practical role in state activities such as the exercise of extraterritorial enforcement jurisdiction.Footnote ²² In such situations, tech companies become necessary intermediaries for states to exercise their authority in the transnational context.

In addition to corporate entities, a broad range of other private actors can benefit from certain digitalization-driven shifts.Footnote ²³ In international investment law, it is not only companies whose international law protection is broadened in the digital context. Even for individuals it seems at least conceivable, according to Polanco, that investment law norms expand to them as well in novel ways.Footnote ²⁴ This includes in particular the users of platforms and other digital services that involve giving access to the users’ data. If the user as investor of data were to be legally recognized, the personal reach of investment law among individuals would expand in a yet unseen manner. Moreover, there are also other forms of empowerment. For example, digitalization has provided tools to empower private actors in the international legal discourse. These actors have more opportunities to participate in this discourse because international legal documents, as well as related policy and academic texts, are available in a digital and more accessible manner.

The second set of empowered actors is public rather than private in nature: International and regional organizations. As to the former, the United Nations (UN) has been very active in shaping issues regarding the applicability of international law norms in cyberspace. This includes, inter alia, the establishment of Groups of Governmental Experts issuing reports regarding cooperative needs and applicable norms in cyberspace as well as the UN Open-Ended Working Group (OEWG) issuing a report in 2021 on the applicability of international law, especially concerning Information and Communications Technologies (ICTs).Footnote ²⁵ Although such activities are of course part of the general UN mandate, the potential empowerment lies in the fact that in the digital context, this organization assumes a strong role in legal discourse and regarding norm shaping attempts. In comparison, the role of (individual) states in this regard is (so far) less pronounced, especially considering that states do not agree on whether novel legal regulation should be envisaged or not.Footnote ²⁶

Regarding regional organizations that assume a growing role in various regions of the world,Footnote ²⁷ Poli and Sommario discuss this empowerment for the EU.Footnote ²⁸ First, in order for existing international norms to be applied to the digital context, such as in the case of the sanctions regimes in reaction to internationally wrongful acts, factual assessments need to be made. This includes, in particular, detecting cyberattacks and determining their origin.Footnote ²⁹ As this technical determination requires technical capability and expertise not possessed by all states,Footnote ³⁰ regional organizations such as the EU can provide the framework and the resources necessary. The de facto attribution of cyberattacks then would lie in the hands of these actors. Consequently, these actors would be empowered to operationalize the international law regime of state responsibility (without becoming the formal holder of such sanction rights). They would thus have an increased role in the application of existing international law.

Second, such actors are also likely to assume a stronger role for legal standard setting in the digital context. This includes harmonized standards not only for transnational commercial activity in cyberspace but also issues regarding digital human rights and, again in the context of state responsibility, novel legal standards for attribution of actions—for example by fully or partially automatized tools. As has been described as the “Brussels effect”, such standards have the potential of shaping regulatory activities in other regions of the world as well.Footnote ³¹ For the context of state responsibility, Poli and Sommario thus predict that attribution standards developed by the EU “could provide a model for technical attribution to be adopted or adapted by the international community.”Footnote ³² The already quite pronounced norm-shaping capacity of the EU is thus likely to be even more enhanced in the ongoing regulation of the cyberspace. This is confirmed by the EU’s cybersecurity strategy according to which it sees itself as well-placed to “advance, coordinate and consolidate Member States’ positions in international fora.”Footnote ³³

1.2 Shifting Power Dynamics Among States

A second actor-related development involves shifting power-dynamics among states related to the use of digital tools. On the one hand, digital tools can empower states that use these tools—or enable or condemn the use by private actors in their interest—for international purposes. This has become particularly salient when public opinion and/or elections are being manipulated by automatized tools such as “bots” and the use of Big Data. Such tools are readily available for a broad range of states, providing interference possibilities even for otherwise less powerful states. As Willmer points out, states are aware of this novel vulnerability,Footnote ³⁴ quoting a statement by the German Ministry of Foreign Affairs that in “cyberspace, only limited resources are often needed to cause significant harm.”Footnote ³⁵ According to Willmer, digitalization “at least for now, changes the assumption that a powerful actor has relatively little to fear from weaker adversaries.”Footnote ³⁶ For international law, this influences the way in which legal arguments are discursively used. For example, the group of states that invoke legal principles such as the principle of non-intervention has changed—it is used more often by conventionally “stronger” rather than “weaker” states.Footnote ³⁷ This corroborates perceptions that international law is used as a tool in power relationships that are either balanced or, if they are unequal, by the weaker party. As the power-dynamics are changing in the digital context, states reassess which legal arguments are useful for them in the relationship with different actors.

On the other hand, we witness a disempowerment of certain states when being targeted by such strategically used digital tools. As Poli and Sommario outline even regarding EU member states, only some states have the technical capabilities to determine where cyber-attacks originate.Footnote ³⁸ This creates novel power-inequalities among states that are the result of varied technical resources. These factual inequalities translate into legal inequalities when not being able to determine the technical origin, prevent states from legally attributing cyber-attacks to other states, and trigger the sanction regime that would apply based on such attribution. In such situations, states are disempowered as to the application of international law.

Furthermore, states can be disempowered with regard to their regulatory capacities. Regulating certain aspects of the cyberspace requires significant resources and expertise that many smaller states might not necessarily have.Footnote ³⁹ This is a phenomenon also addressed as “digital divide” in the development and human rights context.Footnote ⁴⁰ The complexity of the data and cyber-related regulation adopted and envisaged by the EU including the Digital Services Act and Digital Markets Act, the Data Act, the Artificial Intelligence Act, the GDPR and the Cybersecurity Act highlights this aspect.Footnote ⁴¹ For many states, having a coherent domestic regulation and potentially participating in regional or international regulatory efforts of the digital sphere will be difficult due to lacking resources. Similarly, digital tools as objects of potential international regulation are, due to the digital divide, not available (yet) to the same extent in all states, thus making it less likely that certain states participate in regulation on the matter that might eventually concern them as well. As Villareal points out, this is the case in the global health context, which is characterized by a digital divide regarding digital contract tracing tools.Footnote ⁴² As a consequence, states disadvantaged by this divide have a limited role as potential “norm-shapers” in international law due to technical factors and thus even before political power-dynamics come into play.

In sum, there is thus a tendency of empowerment on the side of the users of digital tools for cyberattacks while the disempowerment happens on the side of the targeted states. Such changing power-dynamics appear as a certain equalization, with power differences being less stark. However, as Willmer notes, it remains to be seen whether further technical advancements will cause for power-dynamics to bounce back to their original divergences.Footnote ⁴³

1.3 Possible Emergence of Novel Actors

In addition to existing state and non-state actors, digitalization and especially its automatization dimension has opened the debate for novel actors in international law. This concerns, in particular, international criminal law and the use of force regime. Here, constructing legal personality for AI seems increasingly within the realm of possibilities. As Swart outlines for international criminal law, attributing legal personality to AI might appear one of the options, or even a necessity, to close accountability gaps.Footnote ⁴⁴ If such a legal personality for AI was to be accepted, this would have implications for various fields of international law. It would raise the question as to whether an AI can be a right holder akin to private actors in contexts such as human rights and investment law and whether they can have international obligations akin to states in some or all contexts in which states do. Structurally, acknowledging AI as a legal person would amount to international law broadening its reach in terms of subjects.

In addition to being (potential) subjects of international law, AI can be attributed a norm-creating function. As Tsagourias outlines for the use of force regime, it is indeed conceivable that the artificial actors can play a role in the creation of international customary law.Footnote ⁴⁵ AI activities can be potentially considered as part of assessing practice and opinio juris.Footnote ⁴⁶ This again would mean a certain disempowerment of traditional actors, especially, states. Yet this disempowerment would be a self-inflicted one given that human actors within states decide, for example in the context of the use of force, to use AI for their purposes. The disempowerment would thus come with the technical advantages that states enjoy when using automatization.

In general, the international law debate mirrors aspects of AI-related discussions on the domestic level. This includes questions such as legal personality for AI, issues of liability and attribution in tort and criminal law, as well as the adjustment of procedural rights when administrative or even judicial decision-making is partially or fully automatized.Footnote ⁴⁷ As the automatization on the domestic level is in various ways (especially regarding automatized decision-making) more advanced than the international level, it is likely that domestic law will shape these questions first. International law is then expected to follow the predominant domestic approach, rather than shaping these questions in an original manner.

In addition to the discussion about the legal personality of AI, a further novel legal actor might be emerging. For the human rights context, Shany points to the construction of a “digital personality” or “online personality” which would be recognized as a legal entity that is separate from the physical person related to it.Footnote ⁴⁸ Such an online personae as right holder or potentially even duty bearer regarding human rights would further extend the range of actors in international law.

In sum, the impact of digitalization on the actors in international law fosters existing tendencies and creates novel trends. So far, this is only the beginning of how digitalization could change the international legal actors in the future. It is however certain that the ongoing and emerging shifts already touch upon the very structures of international law.

2.1 Flexibilization, Informatisation and Different Regulatory Fora

In its reaction to digitalization, international law shows its limited adaptability that characterizes it in other contexts as well.Footnote ⁴⁹ Formal amendments to existing treaty law, or the adoption of novel multilateral instruments is thus judged as unlikely by most contributors to this special issue in their respective fields. Tsagourias summarizes a range of factors that prevent states from regulating digitalization by multilateral treaties:

As a consequence, international law adapts in different ways. This includes a flexibilization of existing norms, and informalization of norm-creation, and the use of different regulatory fora.

First, we can observe for various fields of international law that existing norms intended for non-digital contexts are expanded to respond to regulatory needs generated by digitalization. In enforcement law, flexibilization of existing norms takes place by broadening the scope of application of norms with open or discretionary content to other than the original sub-regime.Footnote ⁵¹ For human rights law, one can observe a “radical reinterpretation of existing human rights in order to allow them to meet the new conditions of the digital age”, as exemplified by freedom of expression and the right to privacy.Footnote ⁵² In investment law, the broad scope of application of existing treaty norms such as the definitions of investment and investor makes it comparatively easy to include digital assets.Footnote ⁵³ And in the WTO regime, which so far has not been used as much for the regulation of digital trade, some potential for the flexibilization of existing norms exists as well. This includes technologically neutral rules such as the principles of most-favored nation and national treatment that could be applied to digital trade; and the dispute resolution mechanism which provides a framework for a dynamic interpretation of norms so as to match digital trade requirements.Footnote ⁵⁴ In contrast, a possibility of judicial flexibilization of norms does not exist for fields such as the use of force regime which is generally not the object of judicial decision-making.Footnote ⁵⁵

Second, the trend towards an informalization of international law materializes in the digital context as well.Footnote ⁵⁶ Examples include the Tallinn Manual on cyber warfare which is a non-binding, academic document, or the voluntary Code of Conduct for Information Security proposed by the Shanghai Cooperation Organization, and, as Willmer highlights, the reports of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace, which focuses primarily on non-binding norms.Footnote ⁵⁷ The risk of such informalization for the formal body of international law is twofold. If international legal actors perceive the guiding effect of informal norms as sufficient, the added value of binding legal rules as a regulatory tool for future purposes might become less salient to them. And as regards existing binding law, if informal norms are created that overlap with formal ones, the content of the latter might be “informalized” and thus its bindingness put into question.Footnote ⁵⁸ The structural impact of informalization, including when it is fostered by digitalization, is thus both general and specific in nature.

Third, when formal regulation takes place in the digital context, there is a shift from multilateral to bilateral, and from global to regional regulation. The former trend is particularly pronounced in international trade law. While the WTO as multilateral forum would be an appropriate regulatory framework for digital trade, it can “deliver neither swift nor comprehensive solutions.”Footnote ⁵⁹ As a result, states have turned to Free Trade Agreements as bilateral or at the most plurilateral instruments in order to regulate international trade. For these instruments, Burri observes that “that the move towards more, more detailed and more binding provisions on digital trade has intensified significantly over course of the past few years and there is also a recent trend of adopting dedicated Digital Economy Agreements.”Footnote ⁶⁰ This regulatory trend is thus somewhat opposed to the informalization described above. It seems that in fields of international law, in which bilateral and plurilateral agreements make sense, states opt for formal legal regulation of the digital sphere, while in areas where this is not useful, informalization prevails. What is more, regional approaches to regulating digitalization have become more pronounced. This includes divides between authoritarian and democratic states, for example with regard to cyberattacks and the principles of non-intervention.Footnote ⁶¹ But there is also a divide between western states such as highlighted by the diverging approaches that the EU and the US take on various digitalization-related issues including data and digital trade, data protection regulation, or the applicability of certain human rights to the digital sphere.Footnote ⁶²

Where international law is adapting to digitalization, it thus does so in ways that contributes to ongoing structural developments in international law, such as informalization and regionalization.Footnote ⁶³ As digitalization requires ongoing and large-scale legal adaptation, it is likely to fuel these developments substantively.

2.2 New Dimensions of Fragmentation

A further effect that digitalization has on international legal norms concerns the emergence of regulatory regimes that are fragmented in novel ways. This digital fragmentation has two dimensions.

To start with, fragmentation is created by parallel regulatory attempts. This occurs when different fields of international law or different regulatory fora address a single phenomenon created by digitalization and regulate it, or aspects of it. An example of this are cyberattacks. In the international law discussion of how to qualify and confront them legally, cyberattacks are being addressed from the perspective of the use of force regime, the principle of non-intervention, and state responsibility more generally. Further, there is a fragmentation of regulatory processes regarding cyberattacks. As Willmer outlines, different fora (such as UN Governmental Group of Experts, Open-Ended Working Group, and Programme of Action) tackle the same issue in a parallel manner.Footnote ⁶⁴ With regard to cyberattacks, these fragmented discussions and regulatory attempts are still ongoing. In contrast, in international trade law, we already see fragmented treaty norms for digital trade matters. Free Trade Agreements have been used as legal instruments to regulate digital trade instead of the multilateral WTO framework. This form of digital trade regulation has fragmented an area of law that, due to its global scale calls for more uniform standards.Footnote ⁶⁵ Furthermore, for other subject matters, there is a fragmentation of regulatory attempts originating from the international, domestic, and transnational sphere. One can observe this in the regulation of digital corporate entities and in the establishment of human rights standards for the digital realm.

This dimension is fueled by, and contributes to, the already existing and much discussed fragmentation of international law along subject matter lines as well as the multiplication of regulatory fora.Footnote ⁶⁶ The latter includes diverse coexisting international fora as well as the coexistence of international, transnational, domestic, private, and public regulatory activities. However, the digitalization-related dimension of fragmentation is not particular to public international law, despite its predisposition for fragmentation. In fact, the insufficient coordination among various private international law fora for legal harmonization is seemingly very pronounced with regard to digitalization-related regulation as well.Footnote ⁶⁷ Digitalization is thus challenging in its fragmenting potential also for other areas of law other than public international law.

A second dimension of fragmentation occurs where different regulatory regimes for the digital and the non-digital context are created.Footnote ⁶⁸ This seems so far to be an emerging trend in various fields of international law. In investment law, this phenomenon is already quite common. In particular, there are different regimes for traditional types of investments in the digital economy and purely digital assets.Footnote ⁶⁹ While for the former, the prevailing approach seems to be to apply the existing rules, the latter is generally not covered by existing regulation. Some instruments thus include particular rules for digital assets. Further, in international human rights law, a new set of digital rights has developed that is specific to the digital sphere, including for example the right not to be subject to automated decisions and the right to be forgotten.Footnote ⁷⁰ In contrast, for other fields of international law, parallel regimes for digital and non-digital contexts are still only part of the discussion rather than the lex lata. For enforcement law, Ryngaert suggests that a “better option may be to accept the principled international lawfulness of ‘extraterritorial’ enforcement jurisdiction over digital data […which] would leave intact the traditional prohibition of extraterritorial enforcement jurisdiction in the non-cyber domain.”Footnote ⁷¹ This amounts to parallel regimes for enforcement jurisdiction in the digital and the non-digital sphere. Further, concerning sanctions against cyberattacks, Poli and Sommario point to an emerging discussion about whether different regimes for cyber and non-cyber sanctions should be developed.Footnote ⁷² They observe however that the practice of the EU does not seem to move in this direction yet, as the official position still is to (only?) apply existing norms to the cyber context. Finally, an additional and potentially very impactful—so far still potential—development is highlighted by Tsagourias: It seems possible that parallel sets of secondary rules of norm creating in international law might emerge, especially with regard to customary law.Footnote ⁷³ Such a development would fully institutionalize a divide in international law between digital and non-digital regulation. Both the process of norm-creation and the content of the norms would diverge, creating autonomous legal spaces for digital and non-digital law. Such fragmentation would reach an entirely new level as compared to the “classical” fragmentation and alter the structures of international law to a yet unseen extent.

2.3 Ambiguities and Legal Gaps

An impact of digitalization on law that comes naturally with any major societal or technical change is a certain amount of ambiguity and even legal gaps when novel phenomena first occur.Footnote ⁷⁴ The more legal regulation addresses these phenomena, the less law will be ambiguous or regulation incomplete. However, such development is not a given for international law in the digital context. To start with, the extent to which digitalization has changed and continues to change societal and technical parameters is considerable, thus necessitating large scale legal adaptation. Further, the ongoing change happens at a speed that requires constant and continued regulatory adaptation. And, due to its structurally limited adaptability, such adaptation is a particular challenge for international law. As a consequence, ambiguities and legal gaps can be expected to be more widespread and long-lasting in formal international law than would be the case in domestic law or with regard to informal norm-setting. The following examples show that ambiguities and legal gaps are indeed very characteristic for international law in the digital context.

The indeterminacy in the scope and content of the rules on the use of force has been analyzed in detail by Tsagourias. He shows that in terms of creating legal ambiguities, digitalization has, as regards the use of force regime, fallen on fertile ground. There is only a small body of rules to begin with, and those norms use “vague and open-ended language.”Footnote ⁷⁵ According to Tsagourias, digitalization thus exacerbates the resulting uncertainties. In particular, the definition of what constitutes “digital force”, and which kinds of physical, non-physical, direct, and indirect effects are included remains ambiguous.Footnote ⁷⁶ In addition, there is a broad range of fact-related uncertainties that make the applicability of the use of force regime uncertain. This includes difficulties to analyze existing data, to prove causation and to establish intent. As this is the basis for applying the rules on attribution, it remains unclear whether and how to apply these rules when these difficulties occur.Footnote ⁷⁷ Both legal ambiguity as well as legal gaps can ensue with regard to individual norms as well as to the applicability of the regime as such. As to cyberattacks, it is particularly challenging to clearly distinguish between the applicability of the use of force regime and the self-defense rules on the one hand and state responsibility and counter-measures on the other hand.

Similarly, cyberattacks create “regulatory vagueness” with regard to the principle of non-intervention.Footnote ⁷⁸ Although states agree that this principle applies in cyberspace, its content in the digital realm remains ambiguous. In particular, it remains unclear what coercion means when digital tools are being used, for example for election interference. Neither have customary legal standards emerged yet nor are states willing to create treaty law to solve these questions.

Such ambiguity as to the distinction between different legal regimes also occurs beyond the context of cyberattacks. Regarding jurisdictional regimes, Ryngaert points to the fact that the lines between the norms for prescriptive jurisdiction and those for enforcement jurisdiction are blurred by digitalization.Footnote ⁷⁹ Norms from the former regime such as genuine connection and reasonableness are transferred to the latter regime. For Ryngaert, this regime ambiguity is “digitalization’s main transformative effect on the law of jurisdiction.”Footnote ⁸⁰ What is more, the rules borrowed from prescriptive jurisdiction also carry their own element of ambiguity into the enforcement jurisdiction regime. The more flexible “case by case approach” of the prescriptive jurisdiction regime makes, when transposed to enforcement jurisdiction, legal outcomes more unpredictable than was previously the case.Footnote ⁸¹

Another example of regime ambiguity is provided by international trade law. The distinction between goods and services is difficult to maintain for digital trade phenomena. As Burri outlines, digitalization has raised “critical questions of whether previously not existing digital offerings should be classified as goods or services (and thus whether the more binding General Agreement on Tariffs and Trade [GATT] or the GATS apply), and if categorized as services, under the scope of which subsector they would fall.”Footnote ⁸² Regime boundaries are thus blurred here as well.

What is more, in particular regarding the use of AI, not only ambiguities as to applicable norms but also explicit legal gaps exist. For example, the specific algorithms on which artificial tools and agents are based have not been assessed by international legal standards yet. Relevant judicial fora in this regard would be the regional human rights courts but also, for the specific case of Facebook, the Meta Oversight Board, for which such a competence has been already discussed.Footnote ⁸³ Further, “protection gaps” exist in the human rights context also for other aspects such as exemplified by the discussion about a right to access the Internet.Footnote ⁸⁴

A last aspect that bears mentioning is that ambiguities and legal gaps in international law are often not accidental. Rather, states seem, for strategic reasons, to prefer to keep international legal rules indeterminate as to digital regulatory issues. As Poli and Sommario observe, “[t]here seems to be a general trend among States to refrain from establishing rigid legal frameworks in the area of cyber operations, also in light of the fast technological development. Many States have chosen to adopt a policy of silence and ambiguity about how international law applies in cyberspace.”Footnote ⁸⁵

The strategic interest of states here lies in broadening their room for—legally not explicitly forbidden—behavior. For example, when it comes to classifying a cyberattack as use of force or not, ambiguous rules give leeway to states to choose self-defense or counter-measures as a reaction to such attacks. At the same time, a strategic consideration against creating unambiguous norms can also be the risk of narrowing the reach of existing legal norms. A new regulatory process may render certain existing norms optional that otherwise might not be perceived as such. States could pick and choose which rules to include into a new treaty,Footnote ⁸⁶ and specific norms could open “the gate for an argumentum e contrario for putting in question the applicability and legally binding character of customary international law, general principles of law and treaty obligations with regard to ICTs.”Footnote ⁸⁷

Despite these strategic benefits that states might see in legal ambiguities, there are risks for the respective legal norms—and for the international rule of law in general. Tsagourias warns that ambiguity might lead to norm decayFootnote ⁸⁸ due to a potential “rejection of particular rules on the use of force for example the rule on self-defence or . . . rejection of the whole regime if states or individuals lose faith because, in their opinion, the regime is not normatively and regulatorily cost effective.”Footnote ⁸⁹ Further, a lower scale impact that does not go as far as norm decay would be to diminish the guiding function of the norms. When the content of norms or their applicability is ambiguous, these norms do not, or not as much, guide the behavior of states and other international actors. Ambiguities, when they occur at a large scale and persist over a considerable time, thus have the potential to affect international law severely and structurally. With respect to the ambiguities triggered by digitalization, it is likely that they will be, at least in some fields of international law, long-lasting in nature, thus increasing the risk of affecting international law substantively.

2.4 Hybridity

A final impact of digitalization on international norms is the hybridization of legal norms and spaces. Hybridization occurs when legal elements belong to more than one legal space at once.Footnote ⁹⁰

A first form of hybridization caused by digitalization is regime overlaps. This development can be triggered when existing norms are applied more broadly than initially intended. In such situations, formerly distinct legal regimes such as enforcement jurisdiction and prescriptive jurisdiction can start to share norms that are applied to both. Further, regime overlaps can occur as a result of parallel regulatory attempts. As described above for cyberattacks, different regimes can try to regulate a single phenomenon created by digitalization. In this case, each regime concerned expands to a new regulatory object, thus leading to a multilayered normative framework regarding this object. This multilayered normative body becomes hybrid when its elements interact, thus forming an integrated whole. In contrast, without such interaction, the respective subject matter remains fragmented. For the context of digital human rights law, one can observe both these forms of regime overlaps. As noted by Shany, parallel regulatory attempts of digital rights as well as the broadening of existing norms and discourses beyond regime boundaries foster an ongoing process in which boundaries between international human rights law and other branches of international law are blurred or even “disappearing.”Footnote ⁹¹

A second form of hybridization is the emergence of hybrid legal spaces. This occurs for example when sets of international legal norms such as human rights are interwoven with norms created by private entities such as in the context of platform law. The resulting body of law is hybrid in nature. The interaction among the elements of this hybrid space occurs in various forms. The norms as such can refer to other subsets of the space, for example when the Meta standards refer to international human rights law as part of the applicable law by the Oversight Board.Footnote ⁹² Further, the actors who engage with, and apply, the relevant norms —especially judicial actors—can create discursive interactions. In the Platform Law context, a potential judicial dialogue between classical judicial bodies on the international level on the one side and “transnational hybrid courts” on the other side would enhance the hybridization and expand it to the transnational human rights regime more broadly.Footnote ⁹³

In sum, the already existing and further expected impact of digitalization on international legal norms is multilayered and structural in nature. Among the effects addressed above, some are common to legal norms of different origins, including domestic legal norms, while others are specific—or at least particularly pronounced—for international law. For example, what has been discussed as ambiguity and legal gaps seems more prominent on the international level, given the structurally lower adaptability of (formal) international law than of other legal norms which can be more easily replaced, adapted, expanded etc. by regulatory and judicial actors. Further, trends such as hybridization are perceived as especially impactful for international law as it seems to affect its status as “autonomous” legal space.

3.1 Values Challenged

A value that is prominently challenged is territoriality as a reference point for international regulation.Footnote ⁹⁴ In many fields of international law, territoriality is reassessed in the digital context.Footnote ⁹⁵ For investment law, this challenge is very pronounced. As Polanco outlines, it concerns a range of aspects such as the fact that a territorial link for digital investment is difficult to establish; that the role of electronic residency in the context of the investor definition requires the territorial element of residency to be reconsidered; and that for digital assets, their “boundless nature [makes] them seemingly incompatible with geographically based law.”Footnote ⁹⁶ For international human rights law, Shany argues that “the territorial focus” of this regime “is eroding” and that the emergence of digital human rights is one of the driving factors behind this development.Footnote ⁹⁷ Digitalization has contributed to various human rights courts and bodies recognizing a form of extra-territorial application of these rights. In addition, the business and human rights approach also fosters the regulation by states of extra-territorial impacts of private commercial actors.Footnote ⁹⁸ Further, with regard to various areas of law, the territorial dimension of (state and institutional) jurisdiction is challenged. To start with, this is the case for novel legal constructions such as the dispute resolution mechanism created by Meta. As Gulati observes, the jurisdictional framework of the Oversight Board “has deterritorialized the rules on personal jurisdiction, being rules which historically have been primarily based on the connecting factor of territoriality.”Footnote ⁹⁹ As to states, both their prescriptive and enforcement jurisdiction are being deterritorialized in the digital context. For prescriptive jurisdiction, territoriality is more and more flexibilized.Footnote ¹⁰⁰ When regulating the cyberspace, states interpret territoriality broadly and have to find novel approaches when considering “how a genuine (territorial) connection with the regulating State [can] precisely be established.”Footnote ¹⁰¹ Alternatively, states use the notion of extraterritorial jurisdiction, a normative approach that, although it has always existed in prescriptive jurisdiction, is fostered in the digital context.Footnote ¹⁰² In contrast, as Ryngaert outlines, the value-shift in enforcement jurisdiction is more radical. Enforcement jurisdiction has traditionally been strongly linked to territoriality. In the cyberspace, territoriality is “fading into irrelevance.”Footnote ¹⁰³ To start with, there are numerous factual limits that make a territorially anchored enforcement jurisdiction difficult. This includes the following aspects:

Due to these factual challenges, states have started to unilaterally adopt a non-territorial approach, creating a de facto extra-territorial enforcement jurisdiction. For example, they directly assess data using remote techniques or source data using intermediaries.Footnote ¹⁰⁵ As a legal reference point, they replace territoriality “by such flexible notions as effects, connections and interests.”Footnote ¹⁰⁶

This challenge to territoriality as value in international law is not an entirely new phenomenon that would be only observable in the digital context. Rather, tendencies towards a deterritorialization have been described for international law for some time now.Footnote ¹⁰⁷ However, here again, it is fair to say that the extent of factual deterritorialization that comes with data volatility and unknown or random data location goes beyond previous phenomena. Consequently, territoriality as a value for legal regulation of the cyberspace sits on a weak basis.Footnote ¹⁰⁸

A second value that is considerably challenged is the idea of a human-centered international responsibility. This is relevant for all fields of international law in which agency is a crucial reference point for regulation and in which autonomous or semi-autonomous agents play a role.Footnote ¹⁰⁹ This is for example the case in international criminal law for which Swart argues that such autonomous agents “necessitate a rethinking of . . . the insistence on human agency in international criminal law.”Footnote ¹¹⁰ As she points out, this “will also require a rethinking of the purposes of international criminal law and the extent to which the preoccupation with the individual continues to serve these purposes.”Footnote ¹¹¹ In fact, this observation is true for each regulatory area in which automatization is relevant. The regulatory purposes will need to be reassessed to determine whether a human-centered approach is essential for law to fulfill its assigned functions or whether these functions make it possible to incorporate non-human entities into the regulatory subjects. This includes, in particular, considering whether AI should be attributed legal personality. But as the discussions regarding the use of force regime show, legal impacts beyond immediate subjecthood exist as well. A central notion affected by a human or non-human reference point is attribution of AI actions to states. This challenges the human-centered international responsibility per se which traditionally traces back attribution at least indirectly to human actors. Immediate attribution of automatized actions would broaden this approach. What is more, if one considers, as Tsagourias does, that autonomous digital agents could contribute to practice and opinio juris in the context of customary law creation, the human agency for norm creation would also be challenged.Footnote ¹¹² This would constitute a shift in foundational values not only of international law but of law in general.

International law shares this challenge for human-centered regulation with other fields of law, such as, on the domestic level, tort law, criminal law, administrative law or procedural law more generally. Here, although an immediate role of AI in legislative processes is so far not discussed, the challenge to human-centricity also includes both AI as potential subject of law as well as automatized legal agency such as in the context of automatized administrative decision-making or the use of AI in judicial decision-making.Footnote ¹¹³

In addition, digitalization challenges in a more indirect manner the human-centricity of specific fields of international law such as human rights law and international criminal law. It fosters ongoing developments with regard to international legal obligations of corporate entities. In particular, the “business and human rights” approach is reinforced by the de facto human rights relevance of digital tech companiesFootnote ¹¹⁴ as well as by their active regulatory role when creating “Platform Law.”Footnote ¹¹⁵ Similarly, the use of AI fosters existing debates on corporate responsibility for international crimes.

3.2 Values Reinforced

While the above values are challenged, others are reinforced in, and expanded to, the digital context. A first set of such values are procedural values. For private models of adjudication as the Meta Oversight Board created by digital tech companies, procedural values are center stage. This includes access to justice of the users concerned, and thus accountability of these companies, as well as institutional values such as judicial independence. As Gulati outlines, Meta has indeed gone to great length to explore novel ways of guaranteeing judicial independence of a privately created judicial dispute resolution mechanism.Footnote ¹¹⁶ The innovative trust structured used to construct the institutional independence of this body is but one element that indicates that the relevant corporate actors in the digital tech sphere support and emphasize this value. Moreover, the fact that such a mechanism has been created in the first place promotes access to justice as a value in the transnational sphere. At the same time, this emphasis on access to justice has the potential to put a spotlight on existing deficiencies as to dispute resolution mechanisms on the international level such as the deficient access to justice against acts of international organizations.Footnote ¹¹⁷ Procedural values could thus be boosted more generally in the international and transnational realm. This could counterbalance the structural differences that contribute to procedural values being implemented to different extents in the transnational and international context. These differences include a higher visibility by, and awareness of, the general public of access to justice deficits against digital tech companies as compared to access to justice deficits against international organizations. And due to this visibility as well as to the sheer number of users concerned as compared to the individuals concerned by detrimental international organizations’ activities, the power-dynamics make it more likely that access to justice is optimized in the transnational digital context.

Procedural values are also fostered where international trade law engages with digitalization. For the regulation of digital issues, novel for a are used which reflect procedural values differently than it is the case for traditional trade for a. Participatory rights, accountability and transparency are a more prominent part of regulatory forms such as Free Trade Agreements as compared to the state-only formats characteristic for WTO trade regulation. As Burri highlights, “FTAs may offer suitable venues, with more open and flexible procedural frameworks and participatory and co-regulatory elements.”Footnote ¹¹⁸

Moreover, wherever AI is targeted by regulatory attempts, procedural values play a crucial role. This includes for example transparency of automatized decision-making for example as to the algorithms used;Footnote ¹¹⁹ and due diligence standards for the users or AI.Footnote ¹²⁰ However, this focus on procedural values might come with a downside. It might, as least in part, replace the legal protection of substantive values. As Tsagourias warns for the context of the use of force regime: “The normative and mandatory regulatory modality of international law” such as the substantive use of force rules might be “replaced by an administrative, managerial and technical regulatory modality” if the focus is shifted to procedural values.Footnote ¹²¹

Further, digitalization contributes to fostering, or even introducing, certain substantive values in international law. To start with, in the debate about non-intervention and its applicability to cyberattacks targeted at influencing domestic elections, democracy as a value was introduced as a potential reference point for this principle.Footnote ¹²² This would go beyond the so far existing normative neutrality as to the political regime which is the object of the principle of non-intervention. Similarly, introducing (as an alternative to the direct reference to democracy) a protection of transparent deliberative processes, as is suggested in the discussion about non-intervention, would create a novel normative layer for this principle.Footnote ¹²³

In the non-intervention context, a strengthened normative focus on state sovereignty has also become apparent. As Willmer shows, this development has various dimensions.Footnote ¹²⁴ First, some states and scholars suggest making sovereignty the direct legal reference point rather than the principle of non-intervention to address cyberattacks.Footnote ¹²⁵ Second, the group of state actors that invokes sovereignty or the principle of non-intervention which is a correlate of sovereignty has broadened.Footnote ¹²⁶ While, for a long time, it was mostly used by non-western and/or authoritarian states, western and/or democratic states have started to refer to it in the context of cyberattacks. As a further indication of this trend, sovereignty has also been stressed in the UN Group of Governmental Experts (GGE) and OEWG reports. Third, and beyond the context of non-intervention, sovereignty as a value is explicitly transposed to the digital sphere when concepts such as “digital sovereignty” or “cyber sovereignty” are developed,Footnote ¹²⁷ and when the control over the free flow of information on the Internet is integrated into this notion as propagated for example by China and Russia.Footnote ¹²⁸ In relation to the Internet, an emphasis on sovereignty has also been described as relevant for the field of human rights.Footnote ¹²⁹

This reinforcement of sovereignty somewhat contrasts with the above-mentioned challenges that the value of territoriality is facing. As sovereignty and territoriality of the state have been closely connected notions, challenges to the latter such as in the case of extra-territorial enforcement jurisdiction, which is perceived as highly sovereignty sensitive, affect this value as well.Footnote ¹³⁰ Yet as sovereignty is also reinforced, this value is, through these opposing developments, reshaped in substance. The territorial connotation of sovereignty loses influence while other dimensions such as a potential deliberative and community-related dimension come into focus. If this development solidified, this would amount to an impactful structural shift in international law’s normative basis.Footnote ¹³¹

A further example of shifting substantive values in the digital context is provided by international trade law. Here, non-economic values are more prominently reflected in novel digital trade regulations. As Burri observes:

This example shows that digitalization can provide an opportunity for reassessing normative choices made in international regulation, even if a value shift is not a necessary result of digitalization or of changing interests triggered by it. The fact that digitalization requires novel regulation can in itself provide an opportunity to emphasize certain values more than in previous regulations of the same subject matter.

In sum, digitalization touches upon a range of values that are foundational for international law. Value shifts have started to occur and have the potential to intensify as digitalization continues to shape societal, economic, and political practice. It bears mentioning that what we observe is not the emergence of a less value-based international law. Rather, legal actors put a stronger focus on some values than on others. For the most part, this means that these actors “merely” modify their normative preferences, as their interests in the digital contexts change. An exception to this is the value of a human-centered international responsibility, for which factual necessity requires a reassessment. The latter aspect also highlights that some of the value-shifts outlined above are particular to the digital context while for others, digitalization fosters pre-existing trends.